Page History

...

...

The following noncompliant code example shows a flawed implementation of the copy assignment operator of a dynamically sizable array class. The implicit invariants of the class are that the array member is a valid (possibly null) pointer and that the nelems member stores the number of elements in the array pointed to by array.The copy assignment operator  The code is flawed because it fails to provide any exception safety guarantee. The function deallocates array and assigns the element counter, nelems, before allocating a new block of memory for the copy. As a result, when if the new expression  expression throws an exception, the function will have modified the state of both member variables in a way that violates the implicit invariants of the class. Consequently, the such an object of the class is in an indeterminate state and any operation on it, including its destruction, results in undefined behavior.

#include <cstring>
 
class IntArray {
  int *array;
  std::size_t nelems;
public:
  // ...

  ~IntArray() {
    delete[] array;
  }

  IntArray& operator=(const IntArray &rhs) {
    if (this != &rhs) {
      delete[] array;
      array = nullptr;
      nelems = rhs.nelems;
      if (nelems) {
        array = new int[nelems];
        std::memcpy(array, rhs.array, nelems * sizeof (*array));
      }
    }
    return *this;
  }

  // ...
};

...

In this compliant solution, the copy assignment operator provides the strong exception safety guarantee. The function takes care to allocate allocates new storage for the copy before changing the state of the object. Only after the allocation succeeds does the function proceed to change the state of the object. In addition, by copying the array to the newly allocated storage before deallocating the existing array, the function avoids the test for self-assignment, which improves the performance of the code in the common case.

#include <cstring>
 
class IntArray {
  int *array;
  std::size_t nelems;
public:
  // ...

  ~IntArray() {
    delete[] array;
  }

  IntArray& operator=(const IntArray &rhs) {
    int * consttmp = nullptr;
    if (rhs.nelems) {
      tmp = new int[rhs.nelems];
      std::memcpy(tmp, rhs.array, nelems * sizeof (*array));
    }
    delete[] array;
    array  = tmp;
    nelems = rhs.nelems;
    return *this;
  }

  // ...
};

...

Code that is not exception safe typically leads to resource leaks, causes the program to be left in an inconsistent or unexpected state, and ultimately results in undefined in undefined behavior at some point after the first exception is thrown.

...

Other Languages

TO DO

Bibliography

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography

...